{"id":"CVE-2023-34063","state":"PUBLISHED","title":"Aria Automation contains a Missing Access Control vulnerability.","description":"Aria Automation contains a Missing Access Control vulnerability.\n\n\nAn authenticated malicious actor may \nexploit this vulnerability leading to unauthorized access to remote \norganizations and workflows.\n\n","publishedAt":"2024-01-16T09:10:09.738Z","updatedAt":"2025-06-20T17:02:26.911Z","severity":{"score":9.9,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","source":"vmware"},"assigner":"vmware","products":["N/A VMware Aria Automation, VMware Cloud Foundation"],"affected":[{"vendor":"N/A","product":"VMware Aria Automation, VMware Cloud Foundation","defaultStatus":"unaffected","versions":[{"version":"Aria Automation 8.14.1, Aria Automation 8.14.0, Aria Automation 8.13.1, Aria Automation 8.13.0, Aria Automation 8.12.2, Aria Automation 8.12.1, Aria Automation 8.12.0, Aria Automation 8.11.2, Aria Automation 8.11.1, Aria Automation 8.11.0      ","status":"affected"}]}],"references":["https://www.vmware.com/security/advisories/VMSA-2024-0001.html"],"weaknesses":["CWE-862"],"ingestedAt":"2026-10-29T20:06:00.499Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/34xxx/CVE-2023-34063.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-34063","state":"PUBLISHED","datePublished":"2024-01-16T09:10:09.738Z","dateUpdated":"2025-06-20T17:02:26.911Z","assignerShortName":"vmware","assignerOrgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateReserved":"2023-05-25T17:21:56.204Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Aria Automation contains a Missing Access Control vulnerability.\n\n\nAn authenticated malicious actor may \nexploit this vulnerability leading to unauthorized access to remote \norganizations and workflows.\n\n"}],"affected":[{"vendor":"N/A","product":"VMware Aria Automation, VMware Cloud Foundation","defaultStatus":"unaffected","versions":[{"version":"Aria Automation 8.14.1, Aria Automation 8.14.0, Aria Automation 8.13.1, Aria Automation 8.13.0, Aria Automation 8.12.2, Aria Automation 8.12.1, Aria Automation 8.12.0, Aria Automation 8.11.2, Aria Automation 8.11.1, Aria Automation 8.11.0      ","status":"affected"}]}],"references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2024-0001.html"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.9,"baseSeverity":"CRITICAL","confidentialityImpact":"LOW","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"description":"VMware Aria Automation Missing Access Control Vulnerability","lang":"en"}]}],"providerMetadata":{"shortName":"vmware","orgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","dateUpdated":"2024-01-16T09:10:09.738Z"},"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://www.vmware.com/security/advisories/VMSA-2024-0001.html","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T16:01:53.537Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-01-16T20:17:51.196207Z","id":"CVE-2023-34063","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-862","type":"CWE","lang":"en","description":"CWE-862 Missing Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-20T17:02:26.911Z"}}]}}}